file[.]exe | Triage™

General

Target
file.exe
Size 365KB
Sample230116-mkdfxahe5z
SHA256 0adee2b2103d1c63c66f4f7d3d1bd459420e43b0771df051c40d984b8d56253d
MD5 cb95ac8876e299ba29c73cee1d9249c4
SHA1 a7ab22594d8385626f6205027501cd64b095e01b
SHA512 55057c2120138945065ab8e4cf761b00f96b2a0649ca14646785c656acbf2c9df1ef1ef14b469ccba952e52cde57adcc297fa9f010ba4bbab8838e5fe6e4111f
SSDEEP 6144:1LJdbbLB9gUaUxdlLnHAUphMhSUcEmvVHe6UjQzrfmRFkXrx6aDHXyUC:1LJdvN+ULLHPhMhSUcHNtUOreirx6Mi
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 365KB

file.exe

IMPHASH 3c0838e28e2e4e9629cb614625ccd9af
SHA256 0adee2b2103d1c63c66f4f7d3d1bd459420e43b0771df051c40d984b8d56253d
MD5 cb95ac8876e299ba29c73cee1d9249c4
SHA1 a7ab22594d8385626f6205027501cd64b095e01b
SHA512 55057c2120138945065ab8e4cf761b00f96b2a0649ca14646785c656acbf2c9df1ef1ef14b469ccba952e52cde57adcc297fa9f010ba4bbab8838e5fe6e4111f
SSDEEP 6144:1LJdbbLB9gUaUxdlLnHAUphMhSUcEmvVHe6UjQzrfmRFkXrx6aDHXyUC:1LJdvN+ULLHPhMhSUcHNtUOreirx6Mi
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

22849

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA EndUpdateResourceW InterlockedIncrement ReadConsoleA GetConsoleAliasA GetCurrentProcess GetFileAttributesExA FreeEnvironmentStringsA GetModuleHandleW EnumCalendarInfoExW GetProcessHeap GetGeoInfoW GetSystemWow64DirectoryA GetPriorityClass WideCharToMultiByte LoadLibraryW CreateEventA GetSystemTimeAdjustment SetMessageWaitingIndicator lstrcmpiA FindResourceExW GetProcAddress FindVolumeMountPointClose VirtualAlloc EnterCriticalSection BuildCommDCBW OpenWaitableTimerA LoadLibraryA OpenWaitableTimerW DnsHostnameToComputerNameA GetCommMask SetCommMask EnumDateFormatsA SetConsoleCursorInfo OpenFileMappingW GetConsoleSelectionInfo LCMapStringW CreateFileA CloseHandle IsBadStringPtrW WriteConsoleW GetConsoleOutputCP WriteConsoleA InterlockedDecrement InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess IsDebuggerPresent ExitProcess GetStartupInfoW GetCPInfo RtlUnwind RaiseException LCMapStringA GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapCreate VirtualFree HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetLocaleInfoA GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle

user32

ScreenToClient ClientToScreen GetDC

advapi32

BackupEventLogW

winhttp

WinHttpSetTimeouts WinHttpReadData

Sharing